#/bin/sh set -xe rm -f ca_key ca_key.pub rm -f user_key user_key.pub rm -f *.cert ssh-keygen -q -f ca_key -t ed25519 -C CA -N '' ssh-keygen -q -f user_key -t ed25519 -C "user key" -N '' sign() { output=$1 shift set -xe ssh-keygen -q -s ca_key -I user -n user \ -V 19990101:19991231 -z 1 "$@" user_key.pub mv user_key-cert.pub "$output" } sign all_permit.cert -Opermit-agent-forwarding -Opermit-port-forwarding \ -Opermit-pty -Opermit-user-rc -Opermit-X11-forwarding sign no_permit.cert -Oclear sign no_agentfwd.cert -Ono-agent-forwarding sign no_portfwd.cert -Ono-port-forwarding sign no_pty.cert -Ono-pty sign no_user_rc.cert -Ono-user-rc sign no_x11fwd.cert -Ono-X11-forwarding sign only_agentfwd.cert -Oclear -Opermit-agent-forwarding sign only_portfwd.cert -Oclear -Opermit-port-forwarding sign only_pty.cert -Oclear -Opermit-pty sign only_user_rc.cert -Oclear -Opermit-user-rc sign only_x11fwd.cert -Oclear -Opermit-X11-forwarding sign force_command.cert -Oforce-command="foo" sign sourceaddr.cert -Osource-address="127.0.0.1/32,::1/128" # ssh-keygen won't permit generation of certs with invalid source-address # values, so we do it as a custom extension. sign bad_sourceaddr.cert -Ocritical:source-address=xxxxx sign unknown_critical.cert -Ocritical:blah=foo sign host.cert -h rm -f user_key ca_key user_key.pub ca_key.pub